{"id":113690,"date":"2024-02-18T22:02:41","date_gmt":"2024-02-18T20:02:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant"},"modified":"2024-02-18T22:02:41","modified_gmt":"2024-02-18T20:02:41","slug":"problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/problemy-privodyashhie-k-obhodu-autentifikaczii-wi-fi-v-iwd-i-wpa_supplicant","title":{"rendered":"Problemet q\u00eb \u00e7ojn\u00eb n\u00eb anashkalimin e autentifikimit Wi-Fi n\u00eb IWD dhe wpa_supplicant.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb paketat e hapura IWD (Intel inet Wireless Daemon) dhe wpa_supplicant, t\u00eb p\u00ebrdorura p\u00ebr t\u00eb organizuar lidhjen e sistemeve klient Linux me rrjetin wireless, jan\u00eb zbuluar dob\u00ebsi q\u00eb \u00e7ojn\u00eb n\u00eb p\u00ebrjashtimin e mekanizmave t\u00eb autentikimit: <\/p>\n
\n
N\u00eb IWD, dob\u00ebsia (CVE-2023-52161) shfaqet vet\u00ebm kur aktivizohet funksionimi n\u00eb modalitetin e pik\u00ebs s\u00eb qasjes, which is unusual for IWD, i cili zakonisht p\u00ebrdoret p\u00ebr t\u00eb organizuar lidhjen me rrjetet wireless. Dob\u00ebsia lejon q\u00eb t\u00eb lidhet me pik\u00ebn e qasjes t\u00eb krijuar pa e ditur fjal\u00ebkalimin, p\u00ebr shembull, kur p\u00ebrdoruesi n\u00eb m\u00ebnyr\u00eb eksplicite jep mund\u00ebsin\u00eb p\u00ebr t\u00eb dal\u00eb n\u00eb rrjet p\u00ebrmes pajisjes s\u00eb tij (Hotspot). Problemi \u00ebsht\u00eb zgjidhur n\u00eb versionin IWD 2.14.\n
Dob\u00ebsia shkaktohet nga mungesa e verifikimit t\u00eb duhur t\u00eb rendit t\u00eb kalimeve n\u00eb t\u00eb gjitha hapat gjat\u00eb negociat\u00ebs s\u00eb kanalit t\u00eb komunikimit me kat\u00ebr etapa, e cila aplikohet gjat\u00eb lidhjes s\u00eb par\u00eb me nj\u00eb rrjet wireless t\u00eb mbrojtur. P\u00ebr shkak se IWD pranon mesazhe p\u00ebr \u00e7do hap t\u00eb negociat\u00ebs s\u00eb lidhjes, pa verifikuar kalimin e hapit t\u00eb m\u00ebparsh\u00ebm, sulmuesi mund, pa d\u00ebrguar mesazhin e hapit t\u00eb dyt\u00eb, t\u00eb d\u00ebrgoj\u00eb menj\u00ebher\u00eb mesazhin e hapit t\u00eb kat\u00ebrt dhe t\u00eb fitoj\u00eb qasje n\u00eb rrjet, duke anashkaluar at\u00eb hap ku kryhet verifikimi i autentikimit. <\/p>\n
N\u00eb k\u00ebt\u00eb rast, IWD p\u00ebrpiqet t\u00eb verifikoj\u00eb kodin MIC (Message Integrity Code) p\u00ebr mesazhin e pranuar t\u00eb hapit t\u00eb kat\u00ebrt. Duke qen\u00eb se mesazhi i hapit t\u00eb dyt\u00eb me parametrat e autentikimit nuk \u00ebsht\u00eb pranuar, gjat\u00eb p\u00ebrpunimit t\u00eb mesazhit t\u00eb hapit t\u00eb kat\u00ebrt, \u00e7el\u00ebsi PTK (Pairwise Transient Key) vendoset n\u00eb nj\u00eb vler\u00eb zero. P\u00ebr pasoj\u00eb, sulmuesi mund t\u00eb llogaris\u00eb MIC duke p\u00ebrdorur PTK zero, dhe ky kod verifikues do t\u00eb pranohet nga IWD si i sakt\u00eb. Pas p\u00ebrfundimit t\u00eb nj\u00eb negociate t\u00eb till\u00eb t\u00eb plot\u00eb t\u00eb lidhjes, sulmuesi do t\u00eb ket\u00eb qasje t\u00eb plot\u00eb n\u00eb rrjetin wireless, pasi pik\u00ebn e qasjes do ta pranoj\u00eb korniz\u00ebn e d\u00ebrguar prej tij, t\u00eb koduar me \u00e7el\u00ebsin zero PTK. <\/p>\n
Problemi i identifikuar n\u00eb wpa_supplicant (CVE-2023-52160) lejon q\u00eb nj\u00eb sulmues t\u00eb t\u00ebrheq\u00eb p\u00ebrdoruesin n\u00eb nj\u00eb rrjet wireless t\u00eb rrem\u00eb, q\u00eb vepron si nj\u00eb klon i rrjetit q\u00eb p\u00ebrdoruesi do t\u00eb donte t\u00eb lidhte. N\u00eb rastin e lidhjes s\u00eb p\u00ebrdoruesit me rrjetin e rrem\u00eb, sulmuesi mund t\u00eb organizoj\u00eb kapjen e trafikut transit t\u00eb pap\u00ebrpunuar t\u00eb p\u00ebrdoruesit (p\u00ebr shembull, k\u00ebrkesat p\u00ebr sajtet pa HTTPS).\n
P\u00ebr shkak t\u00eb nj\u00eb problematike n\u00eb zbatimin e protokollit PEAP (Protected Extensible Authentication Protocol), sulmuesi mund t\u00eb arrij\u00eb q\u00eb t\u00eb anashkalohet faza e dyt\u00eb e autentikimit gjat\u00eb lidhjes s\u00eb nj\u00eb pajisjeje t\u00eb konfiguruar keq nga p\u00ebrdoruesi. Anashkalimi i faz\u00ebs s\u00eb dyt\u00eb t\u00eb autentikimit i lejon sulmuesit t\u00eb krijoj\u00eb nj\u00eb klon t\u00eb rrem\u00eb t\u00eb nj\u00eb rrjeti Wi-Fi t\u00eb besuesh\u00ebm dhe t\u00eb siguroj\u00eb lidhjen e p\u00ebrdoruesit me rrjetin e rrem\u00eb pa verifikimin e fjal\u00ebkalimit. <\/p>\n